Certificate Chain Checker
Analyze PEM bundles, likely order, and hostname fit before you debug trust-store issues
The checker inventories every bounded PEM block, compares canonical issuer and subject names, and verifies each child certificate signature against candidate issuer keys. It also reports CA constraints, key usage, duplicates, missing issuers, alternate paths, validity windows, and DNS or IP SAN fit.
- Paste a certificate bundle or mixed PEM set. Source block order is preserved in the inventory.
- Add a hostname when you want DNS or IP SAN guidance for the leaf candidate.
- Click Analyze chain and review the selected relationship sequence, per-certificate signature evidence, and any alternate issuer findings.
- When output is available, copy or download the suggested leaf, fullchain.pem, or chain.pem file.
A verified signature connects a certificate to the selected issuer key. To check whether your browser or server accepts the chain, test it with that client's trusted roots, revocation checks and certificate policies. Supply all intermediate certificates here; the tool does not fetch them through AIA. A self-signed CA must also be trusted by the client.
- X.509 Certificate Parser Decode one PEM certificate in more detail after you know which cert in the bundle matters.
- Certificate, Key & CSR Matcher Select a certificate from a bundle and compare its public key with a key or CSR.
- PKCS#12 / PFX Inspector Inventory certificates and keys inside a local PFX archive before preparing PEM files.
- Certificate chain basics Read the plain-English guide when you need the trust model behind the chain map.
Can this tell me whether Chrome or Safari will trust the chain?
No. It verifies local certificate relationships but does not load a platform trust store or perform complete path validation.
Why does a hostname mismatch still show a parsed chain?
Because hostname matching is a warning on top of structural analysis. The certificates can still parse and order correctly while the leaf names do not fit your requested host.
Does the order of PEM blocks matter?
It depends on the consumer. Common server fullchain.pem files use the leaf first and then intermediates. The source inventory remains in pasted order; suggested output is clearly separate.
Why is a self-signed certificate not called a trusted root?
Self-signing is a property of the certificate and its key. Trust comes from a separate browser, operating-system, application, or administrator configuration.